Skip to content

[Security] Simplifying the DEV firewall's pattern #20794

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: 6.4
Choose a base branch
from
+6 −10
Open

[Security] Simplifying the DEV firewall's pattern #20794

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a2f1288
[Security]: Simplifying the DEV firewall's pattern
ThomasLandauer Mar 21, 2025
00a2d47
Update security.rst
ThomasLandauer Mar 21, 2025
db90640
Update security.rst
ThomasLandauer Mar 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 5 additions & 9 deletions security.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -497,7 +497,7 @@
# the order in which firewalls are defined is very important, as the
# request will be handled by the first firewall whose pattern matches
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
pattern: ^/(_profiler|_wdt|assets)/
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIRC we have it this way to be in line with the recipe: https://github.com/symfony/recipes/blob/main/symfony/security-bundle/6.4/config/packages/security.yaml#L10

Copy link
Contributor Author

@ThomasLandauer ThomasLandauer Mar 22, 2025 •
edited by javiereguiluz
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, then let's change it there too :-) symfony/recipes#1395

security: false
# a firewall with no pattern should be defined last because it will match all requests
main:
Expand All @@ -509,7 +509,7 @@
# https://symfony.com/doc/current/security.html#firewalls-authentication

# https://symfony.com/doc/current/security/impersonating_user.html
# switch_user: true

Check failure on line 512 in security.rst

View workflow job for this annotation

GitHub Actions / Code Blocks 

[Cache Warmup] In SecurityExtension.php line 399:
                                                                         
  Invalid firewall "main": user provider "app_user_provider" not found.  
                                                                         

2025-03-21T18:04:51+00:00 [info] User Deprecated: Method "Symfony\Component\HttpKernel\Bundle\Bundle::build()" might add "void" as a native return type declaration in the future. Do the same in child class "Sensio\Bundle\FrameworkExtraBundle\SensioFrameworkExtraBundle" now to avoid errors or add an explicit @return annotation to suppress this message.

Check failure on line 512 in security.rst

View workflow job for this annotation

GitHub Actions / Code Blocks 

[Cache Warmup] In SecurityExtension.php line 399:
                                                                         
  Invalid firewall "main": user provider "app_user_provider" not found.  
                                                                         

2025-03-23T10:20:23+00:00 [info] User Deprecated: Method "Symfony\Component\HttpKernel\Bundle\Bundle::build()" might add "void" as a native return type declaration in the future. Do the same in child class "Sensio\Bundle\FrameworkExtraBundle\SensioFrameworkExtraBundle" now to avoid errors or add an explicit @return annotation to suppress this message.

.. code-block:: xml

Expand All @@ -529,7 +529,7 @@
<!-- the order in which firewalls are defined is very important, as the
request will be handled by the first firewall whose pattern matches -->
<firewall name="dev"
pattern="^/(_(profiler|wdt)|css|images|js)/"
pattern="^/(_profiler|_wdt|assets)/"
security="false"/>

<!-- a firewall with no pattern should be defined last because it will match all requests -->
Expand All @@ -555,7 +555,7 @@
// the order in which firewalls are defined is very important, as the
// request will be handled by the first firewall whose pattern matches
$security->firewall('dev')
->pattern('^/(_(profiler|wdt)|css|images|js)/')
->pattern('^/(_profiler|_wdt|assets)/')
->security(false)
;

Expand Down Expand Up @@ -598,9 +598,7 @@
pattern:
- ^/_profiler/
- ^/_wdt/
- ^/css/
- ^/images/
- ^/js/
- ^/assets/
# ...

.. code-block:: php
Expand All @@ -614,9 +612,7 @@
->pattern([
'^/_profiler/',
'^/_wdt/',
'^/css/',
'^/images/',
'^/js/',
'^/assets/',
])
->security(false)
;
Expand Down
Loading